SB2021070506 - Multiple vulnerabilities in Kirby

Description

This security bulletin contains information about 3 vulnerabilities.

1) Input validation error (CVE-ID: CVE-2021-34551)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input within the setLanguage() method when processing the $lang_path parameter on a Windows system. A remote attacker can pass specially crafted input to the application, set a UNC path via the affected parameter and execute arbitrary PHP code on the system.

2) Code Injection (CVE-ID: CVE-2021-3603)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

The vulnerability allows a remote attacker to execute arbitrary PHP code on the target system.

The vulnerability exists due to improper input validation. If the $patternselect parameter to validateAddress() is set to 'php' (the default, defined by PHPMailer::$validator), and the global namespace contains a function called php, it will be called in preference to the built-in validator of the same name.  A remote attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

3) Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CVE-ID: CVE-2021-32735)

CWE-ID: CWE-80 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to execute arbitrary JavaScript code in another user's Panel session.

The vulnerability exists due to cross-site scripting in the Panel ListItem component and related Panel content rendering when displaying field and configuration text. A remote user can inject crafted HTML or script content to execute arbitrary JavaScript code in another user's Panel session.

Exploitation can lead to requests being triggered to Kirby's API with the permissions of the victim.

Remediation

Install update from vendor's website.

References

• https://github.com/getkirby/kirby/releases/tag/3.5.7
• https://github.com/getkirby/kirby/security/advisories/GHSA-2f2w-349x-vrqm
• https://github.com/advisories/GHSA-2f2w-349x-vrqm